Which is exactly the problem - this kind of rule following behaviour for arbitrary and non-sense rules allow for more rules to be implemented without push back.

We as developers and end users have to fight it and not simply argue for the sake of following rules.

It makes zero sense to prevent people from viewing source code of a page when that is how the entire tool chain was built to be used.

They should have made their own native app that couldn't be reverse engineered if they had any mind for real engineering rather than blame 'the web'.

You can be as pissed about it as you like, and I don't have a problem with that. Where I start having a problem is when people say things like "poking around to see what kind of data is exposed by a bug is reasonable testing and not illegal". You wanting something to be legal doesn't make it legal!

Point of order - upstream what is being discussed is 'whitehat' behaviors and tendencies, and whether a behavior is reasonable. This got transmuted to a question of legality by some one downstream, and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised. It seemed like there was some talking past each other going on and I think that is the core of it.

I think I keyed off of "I agree with a parent comment in that someone dropped the ball here and threw him under the bus to protect reputations and prevent any nastiness between the two companies."

>...and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised.

True, but it was not somehow 'out of order' because it was not a rebuttal of the 'whitehat' claims. Given that the article is not primarily about how the author discovered the vulnerability, but the legal problems that ensued, it was not at all unreasonable to point out that acting in accordance with 'whitehat' behaviors and intent is not enough to shield oneself from legal scrutiny. Furthermore, the ensuing discussion, in which various attempts were made to deny this distinction, shows that the point needed to be made!

Objection sustained!

> poking around to see what kind of data is exposed by a bug is reasonable testing and not illegal

Poking around to see what kind of data is exposed by a bug is reasonable.

I’d stop there, and I’d suggest people do that, because it makes for a better society for all of us, regardless of the law. What’s that called? Civil disobedience?

Why bother stopping there? You'll already have committed a felony. Go as far as you want from there! It's civil disobedience, after all!

Real issues arrive when people use "illegal" and "immoral" as if they were interchangeable.